CVE-2022-22991

Command injection through unsecured HTTP calls on Western Digital My Cloud devices

HIGH

8.8

CVSS Score

Published: January 13, 2022 at 08:27 PM UTC

Updated: June 17, 2026 at 04:29 AM UTC

11 products affected across 1 vendorMy Cloud OSMy Cloud PR4100My Cloud EX4100

Using My Cloud by Western Digital?

Get instant alerts when new vulnerabilities affect My Cloud - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.8

Exploit prediction

EPSS 1%

Description

A malicious user on the same LAN could use DNS spoofing followed by a command injection attack to trick a NAS device into loading through an unsecured HTTP call. Addressed this vulnerability by disabling checks for internet connectivity using HTTP.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

My Cloud OS · Westerndigital

95%

v < 5.19.117

Affected range stops below 5.19.117, so it looks safe — our inference, not a vendor statement

westerndigital-wd-cloud (environment) · westerndigital-my-cloud (same device) · westerndigital-my-cloud-dl2100 (same device) · westerndigital-my-cloud-dl4100 (same device) · westerndigital-my-cloud-ex2-ultra (same device) · westerndigital-my-cloud-ex2100 (same device) · westerndigital-my-cloud-ex4100 (same device) · westerndigital-my-cloud-mirror-gen-2 (same device) · westerndigital-my-cloud-pr2100 (same device) · westerndigital-my-cloud-pr4100 (same device)

My Cloud · Westerndigital

60%

My Cloud OS 5 ≤ v < 5.19.117My Cloud OS 5

Affected range stops below 5.19.117, so it looks safe — our inference, not a vendor statement

My Cloud DL2100 · Westerndigitaldevice

80%

All versions

My Cloud DL4100 · Westerndigitaldevice

80%

All versions

My Cloud EX2 Ultra · Westerndigitaldevice

80%